Skip tracing with a log message instead of failing the Gateway

An incomplete tracing provider now turns tracing off for that Gateway
instead of setting Accepted=False, so an observability misconfiguration
does not stop the proxy from being provisioned.

Signed-off-by: Kadir Can Yildirim <252162627+kadircanyildirm-crypto@users.noreply.github.com>

Author: kadircanyildirm-crypto

api/v1alpha1/envoyproxy_tracing_types.go

@@ -38,8 +38,9 @@ const (
 //
 // A provider is only required to set host or backendRefs after the
 // GatewayClass-level and Gateway-level EnvoyProxy configs are merged
-// (see EnvoyProxySpec.MergeType), so completeness is validated during
-// translation instead of by a CEL rule here.
+// (see EnvoyProxySpec.MergeType), so completeness is checked during
+// translation instead of by a CEL rule here. A provider that is still
+// incomplete after the merge turns tracing off for that Gateway.
 //
 // +kubebuilder:validation:XValidation:message="BackendRefs must be used, backendRef is not supported.",rule="!has(self.backendRef)"
 // +kubebuilder:validation:XValidation:message="BackendRefs only support Service and Backend kind.",rule="has(self.backendRefs) ? self.backendRefs.all(f, f.kind == 'Service' || f.kind == 'Backend') : true"

internal/gatewayapi/listener.go

@@ -1055,11 +1055,16 @@ func (t *Translator) processTracing(gwCtx *GatewayContext, envoyproxy *egv1a1.En
 	// fallback to host and port
 	// TODO: remove support for Host/Port in v1.2
 	if len(ds) == 0 {
-		// Validated here instead of by a CRD CEL rule so that a partial provider
+		// Checked here instead of by a CRD CEL rule so that a partial provider
 		// (e.g. only serviceName) can be completed by the GatewayClass-level and
-		// Gateway-level EnvoyProxy merge before the check runs.
+		// Gateway-level EnvoyProxy merge before the check runs. An incomplete
+		// provider only turns tracing off, it does not stop the Gateway from
+		// being provisioned.
 		if tracing.Provider.Host == nil {
-			return nil, fmt.Errorf("host or backendRefs needs to be set on the tracing provider after merging EnvoyProxy configs")
+			t.Logger.Info("Disabling tracing because the merged tracing provider sets neither host nor backendRefs",
+				"gateway", utils.NamespacedName(gwCtx.Gateway).String(),
+				"envoyProxy", utils.NamespacedName(envoyproxy).String())
+			return nil, nil
 		}
 		host, port := *tracing.Provider.Host, uint32(tracing.Provider.Port)
 		ds = destinationSettingFromHostAndPort(settingName, host, port)

internal/gatewayapi/listener_test.go

@@ -916,7 +916,6 @@ func TestProcessTracingServiceName(t *testing.T) {
 		envoyProxy          *egv1a1.EnvoyProxy
 		mergeGateways       bool
 		expectedServiceName string
-		expectError         bool
 	}{
 		{
 			name: "no tracing configuration",
@@ -1089,7 +1088,7 @@ func TestProcessTracingServiceName(t *testing.T) {
 			expectedServiceName: "test-gateway-class", // Should use gateway class name when merging
 		},
 		{
-			name: "tracing provider without backendRefs or host",
+			name: "tracing provider without backendRefs or host disables tracing",
 			gateway: &gwapiv1.Gateway{
 				ObjectMeta: metav1.ObjectMeta{
 					Name:      "test-gateway",
@@ -1112,7 +1111,8 @@ func TestProcessTracingServiceName(t *testing.T) {
 					},
 				},
 			},
-			expectError: true,
+			// An empty expectedServiceName asserts that no tracing config is built.
+			expectedServiceName: "",
 		},
 	}
 
@@ -1177,11 +1177,6 @@ func TestProcessTracingServiceName(t *testing.T) {
 				Gateway: tc.gateway,
 			}, tc.envoyProxy, tc.mergeGateways, resources)
 
-			if tc.expectError {
-				assert.Error(t, err)
-				return
-			}
-
 			require.NoError(t, err)
 
 			if tc.expectedServiceName == "" {

release-notes/current/bug_fixes/9527-tracing-cel-merge.md

@@ -1 +1 @@
-Fixed CRD validation rejecting a per-Gateway EnvoyProxy that overrides only part of the tracing provider (e.g. `serviceName`) when relying on `mergeType` to inherit the rest: the host/backendRefs completeness check now runs after the GatewayClass-level and Gateway-level configs are merged, surfacing an `InvalidParameters` Gateway condition instead of blocking admission.
+Fixed CRD validation rejecting a per-Gateway EnvoyProxy that overrides only part of the tracing provider (e.g. `serviceName`) when relying on `mergeType` to inherit the rest. The host/backendRefs completeness check now runs after the GatewayClass-level and Gateway-level configs are merged, and a provider that is still incomplete turns tracing off with a log message instead of blocking admission or the Gateway.

site/content/en/latest/api/extension_types.md

@@ -6674,8 +6674,9 @@ TracingProvider defines the tracing provider configuration.
 
 A provider is only required to set host or backendRefs after the
 GatewayClass-level and Gateway-level EnvoyProxy configs are merged
-(see EnvoyProxySpec.MergeType), so completeness is validated during
-translation instead of by a CEL rule here.
+(see EnvoyProxySpec.MergeType), so completeness is checked during
+translation instead of by a CEL rule here. A provider that is still
+incomplete after the merge turns tracing off for that Gateway.
 
 _Appears in:_
 - [ProxyTracing](#proxytracing)